What is the CVSS score of CVE-2026-32014?

CVE-2026-32014 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openclaw are affected by CVE-2026-32014?

CVE-2026-32014 allows authenticated attackers on trusted networks to spoof device metadata and bypass command restrictions in OpenClaw, potentially granting unauthorized access to critical node…. A patch is available.

How to fix or mitigate CVE-2026-32014?

Within 24 hours: Inventory all OpenClaw deployments and identify systems running versions prior to 2026.2.26; restrict network access to OpenClaw nodes to essential personnel only. Within 7 days: Implement enhanced monitoring and logging of reconnect platform and deviceFamily field changes; conduct access review of privileged node identities. Within 30 days: Develop and test migration plan to patched version 2026.2.26 or later once available; coordinate with vendor on patch release timeline.

Openclaw CVE-2026-32014

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-19 disclosure@vulncheck.com

GHSA-r65x-2hqr-j5hf

Authentication Bypass Openclaw

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

HIGH 8.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.2.26.

DescriptionCVE.org

OpenClaw versions prior to 2026.2.26 contain a metadata spoofing vulnerability where reconnect platform and deviceFamily fields are accepted from the client without being bound into the device-auth signature. An attacker with a paired node identity on the trusted network can spoof reconnect metadata to bypass platform-based node command policies and gain access to restricted commands.

AnalysisAI

A metadata spoofing vulnerability in OpenClaw allows attackers with paired node identities on the trusted network to bypass platform-based node command policies by manipulating unsigned reconnect platform and deviceFamily fields. This authentication bypass vulnerability affects OpenClaw versions prior to 2026.2.26 and enables unauthorized access to restricted commands with high impact on confidentiality, integrity, and availability (CVSS 8.0). No active exploitation has been reported in KEV and EPSS data is not available, but the vulnerability has been publicly disclosed with patches available.

Technical ContextAI

OpenClaw is affected by CWE-290 (Authentication Bypass by Spoofing), where the reconnect platform and deviceFamily metadata fields are accepted from clients without being cryptographically bound to the device authentication signature. This allows attackers to forge metadata during the reconnection process, effectively impersonating different platform types to circumvent access control policies that rely on platform identification. The vulnerability stems from improper validation of client-supplied metadata that should have been included in the authentication signature to ensure integrity and prevent tampering.

RemediationAI

Upgrade OpenClaw to version 2026.2.26 or later, which includes the fix implemented in commit 7d8aeaaf06e2e616545d2c2cec7fa27f36b59b6a. The patch binds platform and deviceFamily fields into the device authentication signature, preventing spoofing attacks. Until patching is possible, implement network segmentation to limit which nodes can establish paired connections, monitor for suspicious reconnection patterns with mismatched platform metadata, and review node command policies to ensure defense-in-depth beyond platform-based restrictions. Refer to the vendor security advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-r65x-2hqr-j5hf for detailed guidance.